FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-4244

This CVE name corresponds to:

Entered	Topic
2006-12-18	sql-ledger -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-4244 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-4244
Phase	Assigned(20060821)

Description

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.

References

Source	Reference
BUGTRAQ	20060830 SQL-Ledger serious security vulnerability and workaround
BUGTRAQ	20060907 Full Disclosure for SQL-Ledger vulnerability CVE-2006-4244
CONFIRM	http://www.sql-ledger.org/cgi-bin/nav.pl?page=news.html&title=What's%20New
BID	19758
SECUNIA	21689
SREASON	1472
XF	sql-ledger-session-unauth-access(28671)